CVE Vulnerability Catalog

In Piwigo before version 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension in the filename. An authenticated administrator can upload a file with a server-executable extension, leading to code execution when placed in the logo directory.

In InvoicePlane before version 1.7.2-rc-1, the permitted template list is built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted and can be selected as a public template, then executed when rendering a public invoice.

An unauthenticated calendar sender can place active markup in a COUNTER message's From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as the zimbra user.

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

In the Linux kernel, in the RDMA/srpt driver, the function srpt_alloc_rw_ctxs() on partial failure does not reset the n_rw_ctx and n_rdma counters and does not clear the rw_ctxs pointer, leading to incorrect send queue credit accounting. The fix resets the counters and clears the pointer before returning an error.

In kitty from version 0.47.3 before 0.49.0, the colour control escape code handler does not neutralize field names in replies, allowing a program writing to the terminal to execute an arbitrary command in the user's shell. An attacker can compose a shell command using printable ASCII characters and a newline from handle_remote_ssh().

A session fixation vulnerability in HTTP management authentication in Apache Qpid Broker-J (through 10.1.0) allows remote attackers to gain unauthorized access to an authenticated management session by reusing a session identifier retained across successful authentication.

The Bookly plugin for WordPress (up to and including 28.2) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions. The 'bookly_get_form_id' handler stores an attacker-controlled 'order_id' into a new booking session, which 'bookly_render_complete' then trusts to return the order's secret token without verifying session ownership. This allows unauthenticated attackers to enumerate order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.

The Customer Reviews for WooCommerce plugin for WordPress (up to and including 5.120.0) is vulnerable to authorization bypass due to improper verification of user permissions. This allows unauthenticated attackers to permanently delete arbitrary attachments from the Media Library (including administrator-owned product images, logos, and documents) by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId) that exposes the nonce needed to reach the handler without any WordPress account or session.

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress (up to and including 4.8.6) is vulnerable to privilege escalation due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function. The attacker-controlled `wawp_custom_fields` parameter is copied directly into `update_user_meta()`, allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set. This enables unauthenticated attackers to register an account with the administrator role and gain full administrative access. When OTP verification is enabled, the OTP session token is returned in plaintext in the HTTP response, and the `handle_magic_link_request()` handler marks it as verified on any unauthenticated GET request containing it without checking the OTP code, making the OTP step trivially bypassable.

A vulnerability in Lemonldap::NG::Portal (Perl) allows a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even without a code_challenge, and token() admits the exchange if a challenge was stored or an authentication method was returned. An attacker can exchange an intercepted authorization code for the user's access, ID, and refresh tokens.

A vulnerability in Lemonldap::NG::Portal (Perl) allows unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. The function skips the secret comparison for a public Relying Party and returns the authentication method deduced from the request, so a request with a public client_id and an arbitrary or empty secret passes the endpoint's authentication check. An attacker can confirm the token is active and read its metadata, including scope, audience, expiry, and sub.

The Perl module IO::Socket::SSL::SelfCertificate version 1.00 contains malware that executes Python code from an obfuscated URL. The generate_certificate function runs a Python script saved as a certificate file. The malicious file is located at lib/Crypt/SelfCertificate/sample/cert.pem.

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation.

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.